| 1 | #!/usr/bin/env bash |
| 2 | # Wait for successful push CI on one immutable main-v2 candidate. |
| 3 | set -euo pipefail |
| 4 | |
| 5 | if [ "$#" -ne 1 ] || [[ ! "$1" =~ ^[0-9a-f]{40}$ ]]; then |
| 6 | echo "usage: verify-release-push-ci.sh FULL_COMMIT_SHA" >&2 |
| 7 | exit 2 |
| 8 | fi |
| 9 | |
| 10 | candidate="$1" |
| 11 | repository="${RELEASE_REPOSITORY:-esengine/DeepSeek-Reasonix}" |
| 12 | wait_seconds="${RELEASE_CI_WAIT_SECONDS:-1800}" |
| 13 | poll_seconds="${RELEASE_CI_POLL_SECONDS:-10}" |
| 14 | |
| 15 | if [[ ! "$wait_seconds" =~ ^[0-9]+$ ]] || [[ ! "$poll_seconds" =~ ^[1-9][0-9]*$ ]]; then |
| 16 | echo "RELEASE_CI_WAIT_SECONDS must be non-negative and RELEASE_CI_POLL_SECONDS must be positive" >&2 |
| 17 | exit 2 |
| 18 | fi |
| 19 | for command in gh jq git; do |
| 20 | command -v "$command" >/dev/null || { |
| 21 | echo "required command is unavailable: $command" >&2 |
| 22 | exit 2 |
| 23 | } |
| 24 | done |
| 25 | |
| 26 | wait_for_success() { |
| 27 | local sha="$1" deadline runs run_status conclusion |
| 28 | deadline=$((SECONDS + wait_seconds)) |
| 29 | while :; do |
| 30 | runs="$(gh run list --repo "$repository" --workflow ci.yml --commit "$sha" \ |
| 31 | --event push --limit 20 --json headSha,status,conclusion 2>/dev/null || true)" |
| 32 | run_status="$(jq -r --arg sha "$sha" \ |
| 33 | '[.[] | select(.headSha == $sha)][0].status // ""' <<<"$runs" 2>/dev/null || true)" |
| 34 | conclusion="$(jq -r --arg sha "$sha" \ |
| 35 | '[.[] | select(.headSha == $sha and .status == "completed")][0].conclusion // ""' <<<"$runs" 2>/dev/null || true)" |
| 36 | case "$conclusion" in |
| 37 | success) |
| 38 | return 0 |
| 39 | ;; |
| 40 | failure | cancelled | timed_out | action_required | startup_failure) |
| 41 | echo "CI for $sha concluded $conclusion" >&2 |
| 42 | return 1 |
| 43 | ;; |
| 44 | esac |
| 45 | if [ "$SECONDS" -ge "$deadline" ]; then |
| 46 | echo "timed out waiting for successful main-v2 CI on $sha (last status: ${run_status:-missing})" >&2 |
| 47 | return 1 |
| 48 | fi |
| 49 | sleep "$poll_seconds" |
| 50 | done |
| 51 | } |
| 52 | |
| 53 | # A commit whose only changes are under release-notes/ skips the code matrix |
| 54 | # in ci.yml (the `changes` job's notes_only output). Its code is identical to |
| 55 | # its first parent, so the evidence is the nearest first-parent ancestor that |
| 56 | # changed anything else. A root commit is treated as code. |
| 57 | notes_only_commit() { |
| 58 | local sha="$1" files |
| 59 | git rev-parse --verify -q "$sha^" >/dev/null || return 1 |
| 60 | files="$(git diff --name-only "$sha^" "$sha")" |
| 61 | [ -n "$files" ] || return 1 |
| 62 | ! grep -qvE '^release-notes/' <<<"$files" |
| 63 | } |
| 64 | |
| 65 | sha="$candidate" |
| 66 | hops=0 |
| 67 | while notes_only_commit "$sha"; do |
| 68 | hops=$((hops + 1)) |
| 69 | if [ "$hops" -gt 5 ]; then |
| 70 | echo "$candidate sits behind more than 5 release-notes-only commits; refusing to infer its code CI" >&2 |
| 71 | exit 1 |
| 72 | fi |
| 73 | sha="$(git rev-parse "$sha^")" |
| 74 | echo "$candidate changes only release-notes/; requiring push CI on ancestor $sha" |
| 75 | wait_for_success "$sha" |
| 76 | echo "successful main-v2 push CI verified for code ancestor: $sha" |
| 77 | done |
| 78 | if [ "$sha" = "$candidate" ]; then |
| 79 | wait_for_success "$candidate" |
| 80 | echo "successful main-v2 push CI verified: $candidate" |
| 81 | fi |
| 82 |